Wordpress: Constant Hack attempts...need some advise.

Jmz · Feb 28, 2013

If you have a static IP you could only allow access to the wp-admin folder from your computer(s).

I have a site that gets a lot of attempted logins but 90% of them use the admin username so if you get rid of that it becomes less likely they'll get in. If you change the username to something a bit obscure it lowers the odds again.

Stufferizer · Feb 28, 2013

Jmz said:
If you have a static IP you could only allow access to the wp-admin folder from your computer(s).

Jmz is right here. I usually go for a IP-only allow for my sites. This is usually done safest using the .htaccess in the admin-folder. Just put the lines

Code:

order deny,allow
deny from all
allow from paste.your.ip.here

into your .htaccess and you're done

Remember that you can always change the IP via SSH.

audioguy · Mar 1, 2013

You can try all security measures, but at the end of the day, nothing is 100% secure. Like anything, going to 80%-90% secure is easy. The last 10-20% is the hardest.

For instance, if you limit login only from your IP, you basically limit those crackers from testing various exploits from launching directly by calling the WP code. But in shared hosting, they can always crack other accounts and use that as backdoor. If your host doesn't use what is called setuid (web server process runs as separate user for each account) then they can write, overwrite and delete files with the same user id as the web server process. So that is one workaround.

Even with dedicated, you need to make sure your operating system is secure, including web server, database server, etc. Those are also backdoors.

And don't forget too that more plugins mean extra code to maintain. Who assures you they are 100% secure? No one can so those "security" plugin may be the backdoor as well... if leave unprotected.

So in my opinion, get to 80-90% secure. Unless they have a strong reason to get in, they may leave you and decide to turn head to easier targets. One thing I like to emphasize once more: always update to the latest release. It is 3.5.1 right now. That prevents cracking from 99.9% crackers out there. Why? Because very little of them can find exploits. Usually they are no more than script kiddies who use existing exploits found by others.

Those exploits are closed in a matter of hours, or a day. Thanks for opensource code like WP. If you update to the latest, those exploits no longer work. Then again, their time is better spent on thousands of other sites who haven't updated.

Also, keep backups. On site and off site.

Gogol · Mar 1, 2013

My 2 cents

Code:

http://www.blackhatworld.com/blackhat-seo/blogging/495526-guide-make-your-wordpress-blog-hackproof-complete-guide.html#post4821645

SEOWhizz · Mar 1, 2013

Here's a few more WP security tips:

1. Create a more secure user name and password

Username: [27 char alphanumeric]
Password: [27 char alphanumeric]
Set the 'Display username' as something user friendly (not the actual user name), e.g.
Actual user: rbEhoX66upSubsGsGxdiresTYUh
Display user: Jack Dempsey

2. Create one or more decoy admins
(These are not real admins, but will have their 'Role' set to: Subscriber).

To add a new user:
WP > Control Panel > Users > Add User

Username: admin
Password: [27 char alphanumeric]
Role: Subscriber

3. When configuring Login Lockdown, change the number of times to 2-3, and the lockout time to a week or more. Of course, after double checking and making a note of your login details!

4. For new WP sites, do a manual install:
Create MySql Database and user manually, each with secure user name and passwords.

Gogol · Mar 1, 2013

You can still get all the users listed with their usernames and access levels ;-)

SEOWhizz said:
Here's a few more WP security tips:

1. Create a more secure user name and password

Username: [27 char alphanumeric]
Password: [27 char alphanumeric]
Set the 'Display username' as something user friendly (not the actual user name), e.g.
Actual user: rbEhoX66upSubsGsGxdiresTYUh
Display user: Jack Dempsey

2. Create one or more decoy admins
(These are not real admins, but will have their 'Role' set to: Subscriber).

To add a new user:
WP > Control Panel > Users > Add User

Username: admin
Password: [27 char alphanumeric]
Role: Subscriber

3. When configuring Login Lockdown, change the number of times to 2-3, and the lockout time to a week or more. Of course, after double checking and making a note of your login details!

4. For new WP sites, do a manual install:
Create MySql Database and user manually, each with secure user name and passwords.

SEOWhizz · Mar 1, 2013

g0g0l said:
You can still get all the users listed with their usernames and access levels

Yes, the idea of the post was to make it more difficult for the opportunist hacker.

Following on from point 3) above:
Login LockDown has not been updated for over 3 years, so there may be compatibility issues with current WP versions:

Code:

http://wordpress.org/extend/plugins/login-lockdown/

Here's an alternative which I've also used and is pretty popular: Limit Login Attempts

Code:

http://wordpress.org/extend/plugins/limit-login-attempts/

Adding to point 4): Installing WP manually

For those who don't know how to install WordPress manually, here's how...

A Create a Secure MySql Database and User
a) Log into your hosting and create a mysql database
> CPanel > MySQL Database Wizard > Login
b) Create a Database
- New Database: <sitename>_ [28 alphanumeric character name]
c) Create Database User
- Username: <sitename>_[7 alphanumeric character user name]
- Password: [27 character (include special characters) password]

d) Add User to the Database
- Privileges
> All
> Deselect 4 options: Index, Create Temporary Tables, Lock tables, References

- Make a note of: database and user, username's and password's.

B. Installing Wordpress Securely
> Download the latest version of wordpress from http://wordpress.org/
In your hosting > CPanel > File Manager:
- Upload the zip file to the root and extract.
Select all files and move up one level.
Delete the wordpress install folder and zip file.
- Rename wp-config-sample.php to wp-config.php
- Select file: wpconfig.php:
> Select Code Editor
- Copy and paste the MySQL Database, user name and password fields into wp-config.php > 'database_name_here', 'username_here', 'password_here' fields.

- Goto https://api.wordpress.org/secret-key/1.1/salt/
- Each time you refresh, it will create a new set.
> Select All and copy
> Goto wp-config.php
> 'Authentication Unique Keys and Salts.' section
(- contains a random set of keys, and is used to encrypt WP info, e.g. logging in)
> Paste over the existing (8) fields (AUTH_KEY to NONCE_SALT).
> Goto 'table_prefix' section:
> Generate a 27 character alphanumeric field
> Paste into 'wp_ prefix' field. Add underscore at end.
> Code Editor > Save Changes
> Exit File Manager

C. Setting WordPress Login Info
> Goto: http://www.mydomain.com/wp-admin/install.php
> Site Title: [XXX] e.g. My Money Site
> Username: [27 character alphanumeric username]
> Password: [27 character alphanumeric password (can have special characters)]

> Install WP

Duffers5000 · Mar 1, 2013

Okay I think this was an eye opener of a thread. Thanks for all the suggestions..hopefully a few people benefit from all the good ideas.

lagger · Mar 1, 2013

make backups...
No for real! Go now and back it up, cause your gonna lose it other wise.
There are so many things that can happen and with a good back up plan you can have a "who gives a f*** attitude" like I do.

Server side hard drive crash...
Script kiddies get ahold of a zero day hack for wordpress.
A real hacker decides he wants in.
They hack you ftp cause you forgot to change the password..
Your server gets hacked.
A random tsunami wipes out your server and now your looking for a new host..

BACK UPS!!! That is the answer your looking for.!!

Gogol · Mar 1, 2013

Mod security is a pain in the ass, rather than a blessing. If you ever have worked with Forms, you'll instantly catch what I am trying to say... My Alternative is the 5G firewall..

Code:

# 5G BLACKLIST/FIREWALL
# 5G:[QUERY STRINGS]
<ifModule mod_rewrite.c>
 RewriteEngine On
 RewriteBase /
 RewriteCond %{QUERY_STRING} (environ|localhost|mosconfig|scanner) [NC,OR]
 RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC,OR]
 RewriteCond %{QUERY_STRING} boot\.ini  [NC,OR]
 RewriteCond %{QUERY_STRING} echo.*kae  [NC,OR]
 RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
 RewriteCond %{QUERY_STRING} \=\\%27$   [NC,OR]
 RewriteCond %{QUERY_STRING} \=\\\'$    [NC,OR]
 RewriteCond %{QUERY_STRING} \.\./      [NC,OR]
 RewriteCond %{QUERY_STRING} \?         [NC,OR]
 RewriteCond %{QUERY_STRING} \:         [NC,OR]
 RewriteCond %{QUERY_STRING} \[         [NC,OR]
 RewriteCond %{QUERY_STRING} \]         [NC]
 RewriteRule .* - [F]
</ifModule>


# 5G:[USER AGENTS]
<ifModule mod_setenvif.c>
 SetEnvIfNoCase User-Agent ^$ keep_out
 SetEnvIfNoCase User-Agent (casper|cmsworldmap|diavol|dotbot)   keep_out
 SetEnvIfNoCase User-Agent (flicky|ia_archiver|jakarta|kmccrew) keep_out
 SetEnvIfNoCase User-Agent (libwww|planetwork|pycurl|skygrid)   keep_out
 SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|turnit)   keep_out
 SetEnvIfNoCase User-Agent (zmeu|nutch|vikspider|binlar|sucker) keep_out
 <limit GET POST PUT>
  Order Allow,Deny
  Allow from all
  Deny from env=keep_out
 </limit>
</ifModule>


# 5G:[REQUEST STRINGS]
<ifModule mod_alias.c>
 RedirectMatch 403 (https?|ftp|php)\://
 RedirectMatch 403 /(cgi|https?|ima|ucp)/
 RedirectMatch 403 /(Permanent|Better)$
 RedirectMatch 403 (\=\\\'|\=\\%27|/\\\'/?|\)\.css\()$
 RedirectMatch 403 (\,|//|\)\+|/\,/|\{0\}|\(/\(|\.\.\.|\+\+\+|\||\\\"\\\")
 RedirectMatch 403 \.(cgi|asp|aspx|cfg|dll|exe|jsp|mdb|sql|ini|rar)$
 RedirectMatch 403 /(contac|fpw|install|pingserver|register)\.php$
 RedirectMatch 403 (base64|crossdomain|localhost|wwwroot|e107\_)
 RedirectMatch 403 (eval\(|\_vti\_|\(null\)|echo.*kae|config\.xml)
 RedirectMatch 403 \.well\-known/host\-meta
 RedirectMatch 403 /function\.array\-rand
 RedirectMatch 403 \)\;\$\(this\)\.html\(
 RedirectMatch 403 proc/self/environ
 RedirectMatch 403 msnbot\.htm\)\.\_
 RedirectMatch 403 /ref\.outcontrol
 RedirectMatch 403 com\_cropimage
 RedirectMatch 403 indonesia\.htm
 RedirectMatch 403 \{\$itemURL\}
 RedirectMatch 403 function\(\)
 RedirectMatch 403 labels\.rdf
 RedirectMatch 403 /playing.php
 RedirectMatch 403 muieblackcat
</ifModule>


# 5G:[BAD IPS]
<limit GET POST PUT>
 Order Allow,Deny
 Allow from all
 # uncomment/edit/repeat next line to block IPs
 # Deny from 123.456.789
</limit>

mrblackjack said:
find out with your hosting provider, if the following mods are installed on the Apache server:
1. Mod Evasive - useful against DoS / Brute Force attacks
more info here:
http://library.linode.com/web-servers/apache/mod-evasive
2. Mod Security - can monitor the HTTP traffic in real time in order to detect attacks. Useful against Sql injections, etc.
more info here:
http://library.linode.com/web-servers/apache/mod-security

I use both of them with combnation of mod_rewrite to create a set of rules against attackers / spammers.

Gogol · Mar 1, 2013

Hey, please do not take me otherwise. It's not about making the n00bs go away, but it is about making your WP installation Hackproof. The only way I have seen to secure a WP installation completely is to secure the Wordpress admin as I have suggested in my opinion shared in post number 24.

You don't really need 1000 plugins to secure ( and slow down) your WP installation. You just need the most effective one, which is what i just mentioned. WP has some undiscovered bug. How do I know? How can a blog with the default installation ( that was WP 3.4 most probably), default theme, no plugins, changed username and a password having 25 chars ever get hacked?

I have been doing PHP for over 8 years now and I still do not have an answer....

Whatever the bug might be, it has to be in the wordpress plugin editor inside Wp-admin. So how do you prevent it? Just secure your Wp-admin as I have been screaming!!!

P.S. : I am not having a fight with anybody here, it is just self realization which i just wanted to let everybody know....

SEOWhizz said:
Yes, the idea of the post was to make it more difficult for the opportunist hacker.

Zapdos · Mar 1, 2013

In general:
1) Use strong usernames and passwords. Think 32+ characters on each. Never use the same password.
2) Disable security questions if possible. They're much less secure now with people posting everything on Facebook/twitter. Also prone to social engineering. It's easier to ask the name of your first dog than it is for your password.
3) Require IP authentication. If the IPs dont match, deny the request. Also can be done in htaccess. To get a consistent IP you can use a VPN. This also helps with:
4) Use a secure connection. Either HTTPS or implicit HTTPS using a VPN. It will secure the connection between your computer and the VPN server to prevent sniffing by people on your network, your router or your ISP.

To prevent brute forcing the login page itself:
1) Password protect the directory using htaccess! This is the most simple thing to implement and is more secure as it does not use a database or php. It's been around for almost 15 years I believe? Just make sure the username and password are hard to guess
2) Limit login attempts. After X amount of incorrect attempts (5 is a safe bet) it will block them from the login page.

To prevent brute forcing of password hashes:
1) Use a password that is 32+ characters long. This will make it impractical to brute force even for the highly "broken" MD5 algorithm
2) Use a secure hashing algorithm. Using something like phpass with many rounds combined with a long password and unique salts per user make the process impractical for anyone except the USA or Chinese government (processing power.)

To prevent other forms of attack:
1) Only connect to the server using SFTP or FTPES. Plain FTP will send the username and password in plain-text allowing anyone monitoring the connection to see it and login themselves.
2) Disable any unneeded services (if vps/dedi)
3) Only grant SQL privileges as needed.

EDIT: I typed most of this up before, along with some other points. See here: http://www.blackhatworld.com/blackh...-he-best-way-prevent-hacking.html#post4994003

WPRipper · Mar 1, 2013

I think if are just attempts, no need to worries.

Furious George · Mar 1, 2013

This is something about which I know very little.

This is an awesome thread, and thanks to everyone for their input.

I need to stay up all night and change a few things.

Zapdos · Mar 1, 2013

RedDeezer said:
I think if are just attempts, no need to worries.

Attempts are only attempts until they succeed. You dont go "OH FUCK" when they succeed. You do it when they try.

Gogol · Mar 2, 2013

Well said.

Zapdos said:
Attempts are only attempts until they succeed. You dont go "OH FUCK" when they succeed. You do it when they try.

dbyrn · Mar 2, 2013

You people mentioned almost everything. Good work! One thing to be added: for a hacker its always simplier to attack one of the plugins then WP itself. WP is backed up by a team of professionals, plugins are often someone's hobby. So don't use very exotic plugins.
AND MAKE BACKUPS!
D.

cloakndagger2 · Mar 2, 2013

Some awesome advice here and without doubt BACK UP everytime you make a change to the site,there are plenty wordpress back up options like wptwin etc and go buy them so you know there will be no issues.Thanks again for the advice here I'm sure pretty much everyone will learn something from this thread.

MTUser2010 · Mar 2, 2013

I had a situation much like yours over Christmas. A WP Amazon affiliate site for phone accessories that was under constant attack for about a month. In the old days, before I learned much, I wouldn't even have known about it. But with Better WP Security (BWPS) installed, and set up to take care of all plugin's suggestions, change admin, change database prefix, set up lockouts for logins, ban IPs, use blacklist etc, I just watched the notifications from BWPS roll in about 10 to 15 day for 30 days, and the site was never hacked.

I recognize that BWPS is not perfect, and that if someone really wanted above everything else to get in, they probably could. But in terms of work/reward ratio, I think it is hard to beat using it.

IMpossible · Mar 2, 2013

Anybody that's facing constant login attempts by hackers: Whitelist your IP!

Wordpress: Constant Hack attempts...need some advise.

Newbie

Regular Member

Power Member

Administrator

Power Member

Administrator

Power Member

Elite Member

Power Member

Administrator

Administrator

Power Member

Elite Member

Supreme Member

Power Member

Administrator

Power Member

Regular Member

Junior Member

Supreme Member

Main Menu

Marketplace

Making Money

BlackHat World